CAA PAPER 2004/10 Flight Crew Reliance on Automation - www.caa.co.uk - Safety Regulation Group
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Safety Regulation Group CAA PAPER 2004/10 Flight Crew Reliance on Automation www.caa.co.uk
Safety Regulation Group CAA PAPER 2004/10 Flight Crew Reliance on Automation Written by Simon Wood, Cranfield University December 2004
CAA Paper 2004/10 Flight Crew Reliance on Automation © Civil Aviation Authority 2004 ISBN 0 86039 998 2 Published December 2004 Enquiries regarding the content of this publication should be addressed to: Research Management Department, Safety Regulation Group, Civil Aviation Authority, Aviation House, Gatwick Airport South, West Sussex, RH6 0YR. The latest version of this document is available in electronic format at www.caa.co.uk, where you may also register for e-mail notification of amendments. Printed copies and amendment services are available from: Documedia Solutions Ltd., 37 Windsor Street, Cheltenham, Glos., GL52 2DG.
CAA Paper 2004/10 Flight Crew Reliance on Automation
List of Effective Pages
Chapter Page Date Chapter Page Date
iii December 2004
iv December 2004
v December 2004
vi December 2004
vii December 2004
Chapter 1 1 December 2004
Chapter 1 2 December 2004
Chapter 1 3 December 2004
Chapter 1 4 December 2004
Chapter 1 5 December 2004
Chapter 2 1 December 2004
Chapter 3 1 December 2004
Chapter 3 2 December 2004
Chapter 3 3 December 2004
Chapter 3 4 December 2004
Chapter 3 5 December 2004
Chapter 3 6 December 2004
Chapter 3 7 December 2004
Chapter 4 1 December 2004
Chapter 4 2 December 2004
Chapter 4 3 December 2004
Chapter 4 4 December 2004
References 1 December 2004
References 2 December 2004
References 3 December 2004
Annex A 1 December 2004
Annex A 2 December 2004
Annex A 3 December 2004
Annex A 4 December 2004
Annex A 5 December 2004
Annex A 6 December 2004
Annex A 7 December 2004
Annex A 8 December 2004
Annex A 9 December 2004
Annex A 10 December 2004
Annex A 11 December 2004
Annex A 12 December 2004
Annex A 13 December 2004
Annex A 14 December 2004
Glossary 1 December 2004
Glossary 2 December 2004
December 2004 Page iiiCAA Paper 2004/10 Flight Crew Reliance on Automation
Contents
List of Effective Pages iii
Executive Summary v
Preface vi
Background vi
Introduction vi
Chapter 1 Review of Literature
Introduction 1
Review of the Impact of Automation 1
Previous Studies 3
Training Regulations and Requirements 5
Chapter 2 Review of Data
Review of Incident Data 1
Chapter 3 Discussion
General 1
Automation failures 2
Regulations for Training Requirements 4
Chapter 4 Conclusions and Recommendations
Dependency on Automatics Leads Crews to Accept what the Aircraft is
doing without Proper Monitoring 1
Crews of Highly Automated Aircraft Lose Manual Flying Skills 2
Inappropriate Response to Failures 2
CRM Requirements 3
References
Annex A Literature Review
The Role of Automation 1
Recognition of and Reaction to Failure 5
Previous Studies 9
FAA HF Team Report 1996 10
Glossary
December 2004 Page ivCAA Paper 2004/10 Flight Crew Reliance on Automation Executive Summary Modern large transport aircraft have an increasing amount of automation and crews are placing greater reliance on this automation. Consequently, there is a risk that flight crew no longer have the necessary skills to react appropriately to either failures in automation, programming errors or a loss of situational awareness. Dependence on automatics could lead to crews accepting what the aircraft was doing without proper monitoring. Crews of highly automated aircraft might lose their manual flying skills, and there is a risk of crews responding inappropriately to failures. This preliminary report is intended to provide clarification of areas of concern. A detailed literature search was made to understand the problems identified by previous studies into flight deck automation. In parallel a review of relevant incidents occurring on major aircraft types during 2002 and 2003 recorded in the Mandatory Occurrence Report (MOR) database was conducted. Finally, interviews were held with personnel from the following areas: airline training departments (short and long haul), Type Rating Training Organisations, CAA Personal Licensing Department, CAA Flight Operations Inspectorate, and Crew Resource Management/Human Factors (CRM/HF) specialists. Further work would be needed to refine the database search, conduct a survey with line pilots and discuss these issues with the aircraft manufacturers and equipment vendors. The research indicated that there was much evidence to support the concern that crews were becoming dependent on flight deck automation. Furthermore, the new human task of system monitoring was made worse by the high reliability of the automation itself. Little research exists to provide a structured basis for determination of whether crews of highly automated aircraft might lose their manual flying skills. However, anecdotal evidence elicited during interviews and a brief mention in the European Collaboration on Transition Training Research for Increased Safety (ECOTTRIS) study indicates that this is a concern amongst practitioners. Finally, several MOR incidents revealed that crews do respond inappropriately having made an incorrect diagnosis of their situation in which the automation fails. For example, disconnecting the autopilot following an overspeed in turbulence then resulted in level busts. If pilots had a better understanding of the automation then it is likely that the need for manual flying could have been avoided and thus the subsequent level bust. During the course of this research two more fundamental observations were made: • First, pilots lack the right type of knowledge to deal with control of the flight path using automation in normal and non-normal situations. This may be due to operators making an incorrect interpretation of existing requirements and/or a lack of emphasis within the current requirements to highlight the particular challenges of the use of automation for flight path control. • Second, there appears to be a loop-hole in the introduction of the requirements for CRM training. This has resulted in many of the training personnel and managers responsible for the ethos and content of training programmes not fully understanding the significance of the cognitive aspects of human performance limitations. December 2004 Page v
CAA Paper 2004/10 Flight Crew Reliance on Automation
Preface
1 Background
1.1 Risk Identification
The CAA Flight Operations Department, research literature and a number of
international teams involving regulatory authorities and industry have identified
reliance on aircraft automatics as an area of potential risk. This is documented in
numerous research publications and international regulatory authority reports such as
the FAA led Human Factors Task Team Report (1996) and a group within the JAA led
Joint Safety Strategy Initiative (JSSI) known as the Future Aviation Safety Team
(FAST). The latter focused upon predictive techniques to identify new, emergent or
foreseeable future risks to public transport operations.
1.2 Issues Highlighted for Investigation by CAA
1.2.1 There is an increasing amount of automation in aircraft and greater reliance on this
automation by the crew. Consequently, there is a risk that flight crew no longer have
the necessary skills to react appropriately to either failures in automation,
programming errors or a loss of situational awareness. The CAA requested
investigation of the following areas:
• Firstly, dependence on automatics could lead to crews accepting what the aircraft
was doing without proper monitoring. The risk is that if the automatics
malfunctioned, or perhaps more likely the Flight Management System (FMS) was
wrongly programmed, the crew would not realise the problem until too late.
• Secondly, crews of highly automated aircraft might lose their manual flying skills.
It requires a positive intervention from the crew to keep in practice at some
manoeuvres and it becomes all too easy to let the aircraft get on with it. The more
the pilot becomes out of practice the less inclined he becomes to disconnect the
autopilot and fly the aircraft himself. The only requirement for manual flying skills
to be tested is during an engine-out ILS, go-around and landing annually during the
Licence Proficiency Check. Document 24, Guidance to Examiners, now requires
the autopilot to be disconnected prior to the selection of flap and becoming
established on the localiser.
• Thirdly, there is a risk of crews responding inappropriately having made an
incorrect diagnosis of their situation. This in turn could arise when systems are
over-complicated with too many variables to be easily assimilated. There is a risk
that with insufficient depth of training, crews would be unable to interpret
accurately all the eventualities that might be presented.
2 Introduction
2.1 Scope
The issues highlighted for investigation by CAA cover a large area and it was
necessary to define exactly what was and what was not included in the study (Wood,
2004). As a result the study was restricted to the consideration of automation of the
task of control of the flight path using an autopilot and a Flight Management System
on a fixed-wing 'glass-cockpit' commercial aircraft. A taxonomy of failures was
presented that was limited to four classes:
December 2004 Page viCAA Paper 2004/10 Flight Crew Reliance on Automation
• Automation system failure
• Programming errors
• Organisation errors
• Design errors
2.2 Methodology
2.2.1 A detailed literature search was made to understand the problems identified by
previous studies into flight deck automation. In parallel a review of relevant incidents
recorded in the MOR and CHIRP databases was made. The search parameters were:
Airbus, Boeing, Embraer, FMS, autopilot, automation/automatic problems;
1st January 2002 to 31st December 2003. Interviews with personnel from the
following areas: airline training departments (short and long haul), Type Rating
Training Organisations, CAA Personal Licensing Department, CAA Flight Operations
Inspectorate, and CRM/HF specialists.
2.2.2 Further work has still to be done to refine the database search, conduct a survey with
line pilots and discuss these issues with the aircraft manufacturers and equipment
vendors. Additionally, the findings of this interim report will be discussed with
contemporary researchers working for JSSI.
2.3 Layout of this Preliminary report
2.3.1 The report is divided into four Chapters. Chapter One presents a review of the
relevant research literature. The impact of automation on modern aircraft is presented
first, followed by a synopsis of previous studies in this area. Chapter Two covers the
data that was reviewed. Chapter Three presents a discussion of the findings and
Chapter Four presents the conclusions and recommendations.
2.3.2 It must be remembered that this report summarises a brief, preliminary study of the
issues. Delays in receiving appropriate incident data has meant that there are few
analytical findings presented.
December 2004 Page viiCAA Paper 2004/10 Flight Crew Reliance on Automation
Chapter 1 Review of Literature
1 Introduction
1.1 Given that the task facing today's pilots has changed, have the regulatory
requirements for training and the ensuing standards also changed appropriately to
meet such a change? Furthermore, as a result of such training, do the pilots have the
necessary skills to react appropriately to either failures in automation, programming
errors or a loss of situational awareness?
1.2 Equally, the review of modern aircraft automation issues must acknowledge the
continual efforts that are being made to reduce error and mitigate the effects of error.
Training programmes and material have not stood still over the last 30 years and the
general familiarity with automated systems has changed as well. It is with this point
firmly in mind that the conclusions of several studies, ranging over a period of 10-15
years have been presented. It should also be understood that we are not dealing with
one 'subject'. The 'pilot' in the cockpit is a multi-dimensional subject, for example:
status (Captain or First Officer), age (18 – 60 or even 65), experience (200 – 10,000
hrs), or diverse nationality from any JAA member state.
1.3 The following presents a synopsis of the literature review that has been conducted.
A more full account is presented at Annex A.
2 Review of the Impact of Automation
2.1 Introduction of Automation to the Flight Deck
We currently have flight deck automation systems that change the task, re-distribute
workload for the crew, and present situations that induce an error. The change in role
from active, manual control to one of system management has left pilots less
proficient in manual skills but still required, on occasions, to take control in time critical
situations. The architecture of flight deck automation is based on rationalistic
principles that do not readily align with the mental models pilots have for the manual
flying task. Pilots have adapted or bridged this gap by adopting 'work-arounds'. The
way forward is for the evolution of current designs rather than revolution; however,
we still have a problem of mitigating the human-machine problems of extant system
designs.
2.2 Automation Dependency - Complacency
2.2.1 Complacency in the automated flight deck represents an important issue. Pilots may
become complacent in highly reliable automated environments where the role has
become supervisory and lacks practice in direct control. Researchers have reported
that when subjects performed multiple flight related tasks simultaneously, with one
of the tasks being automated, the consistency and reliability of the automation
affected their ability to monitor for automation failure. Detection of automation
failures was poor under constant-reliability automation, even following a catastrophic
failure. However, monitoring was efficient under variable-reliability automation. These
effects do not significantly alter following training.
2.2.2 A further extension of this issue is that the automation need not necessarily 'fail' to
cause a problem of cognition for the pilot. The Bangalore crash involving an Air India
A320 is a case in point. The system did not fail per se, but it did not behave the way
the crew expected it to behave. By the time their effective monitoring alerted them
December 2004 Chapter 1 Page 1CAA Paper 2004/10 Flight Crew Reliance on Automation
to the problem there was insufficient time to intervene and prevent the impact with
the ground.
2.3 Automation Bias
2.3.1 The availability of automation and automated decision aids encourages pilots to adopt
a natural tendency to follow the choice of least cognitive effort. When faced with
making decisions pilots will rely on these automated aids as a replacement for
vigilance, and actively seeking information and processing. This is termed automation
bias. Studies have reported that pilots committed errors on 55% of occasions when
the automation presented incorrect information in the presence of correct information
to cross-check and detect the automation anomalies. Training crews on automation
bias or to verify correct automated functioning had no effect on automation-related
omission errors, and neither did display prompts that reminded crews to verify correct
functioning. However, there was evidence that pilots did perform better depending
on the flight critical nature of the event. For example, they were more likely to notice
an altitude capture error rather than a radio call error in the cruise. These studies also
confirmed the tendency towards over-reliance on reliable automation where pilots
were reluctant to correct automation errors despite recognising and acknowledging a
discrepancy between what they were expecting and what the automation actually
did. Furthermore, an error of commission was committed by nineteen out of twenty
experienced crews who followed a false fire indication and shut down an engine
despite the lack of any other indications of fire. Additionally, results of questionnaires
indicated that these same pilots considered that an automated warning message
alone would be insufficient for them to ensure that the fire was real. Pilots believed
that they saw information that verified the automated cue; this aspect has profound
relevance for the analysis of human factors following incident and accident reports.
2.3.2 Interestingly, after the incorrect decision had been made to shutdown the engine,
crews immediately adopted the rule-based behaviour for the shutdown procedure i.e.
they then verified that they were shutting down the correct engine. The results of
such studies indicate that pilots fail to take into account all of the relevant information
that is present in an automated flight deck. The tendency is for pilots to take cognitive
short-cuts by pattern matching and using rule-based behaviour wherever possible.
Once established in 'familiar territory' the skill-based behaviour completes the task.
2.4 Recognition of and Reaction to Failure
2.4.1 The point at which a pilot would intervene in an automated process is fundamental to
the success of operation i.e. at what point does the automated system stop and
require the human to take over? If the point of intervention is too early then there may
be too many alerts in normal operation or too little information to make full use of the
pilot's experience and problem solving ability. Conversely, if intervention is left too
late then the pilot may well be landed in a deteriorating situation that has reached the
limits of the automated system's capability. Research has shown that rather than
design systems to work on thresholds or specific limits for control there should be a
continuous flow of information to the pilot to indicate the difficulty or increasing effort
needed to keep relevant parameters on target.
2.4.2 If we find ourselves in an unfamiliar situation then we try to make sense of the
disparate data in front of us by using knowledge-based behaviour. However, we will
minimise the cost of cognitive effort by pattern matching so that we can adopt
previously learnt procedures, rule-based behaviour, wherever possible. Again, once
established in 'familiar territory' the skill-based behaviour completes the task.
December 2004 Chapter 1 Page 2CAA Paper 2004/10 Flight Crew Reliance on Automation
2.5 Failures and Situation Awareness
A review of 230 ASRS reports classified failures into two broad classes that reflected
'Emergency' and 'Abnormal' malfunctions. Results indicated wide differences in
adherence to procedures depending on the type of malfunction. The report
suggested that this may be caused by the crew perception of the malfunction, and
training. The malfunctions classified as 'Emergency' had well-developed procedures
that had been practised in the simulator on many occasions thus leading to rule-based
behaviour. However, the Abnormal malfunctions had less well-defined procedures
and therefore required the crew to revert to knowledge-based behaviour requiring
more time and effort to properly assess and resolve the situation. “This refocusing of
tasks likely resulted in reduced levels of procedural accomplishment,
communications and situational awareness”. The report concludes that minor
anomalies often have no immediate or obvious solution; therefore, the crew may
resort to time-consuming thought, and trial-and-error procedures in order to deal with
them.
2.6 Manual Flying Skill
There has been very little research published on the subject of the change in manual
flying skill experienced by crews of highly automated aircraft. Most of the comments
arise from questionnaires and interviews which rely on subjective feedback of the
change in perceived skill. However, it is consistently reported that there is a
discernible reduction in manual flying skills that is correlated both with the use of
automation and whether the operation is long haul or short haul.
3 Previous Studies
3.1 Studies of Pilots' Model and Awareness of the FMS 1989-94
Several studies (Weiner, 1989; Sarter and Woods, 1992 and 1994) indicate that
although pilots were competent in normal operational situations there were gaps in
the pilots' understanding of the functional structure of the automation which became
apparent in non-normal, time-critical situations. Additionally, pilots may not be aware
of the gaps in their knowledge about FMS functionality.
3.2 FAA HF Team Report 1996
The team reported concerns regarding pilot understanding of the automation's
capabilities, limitations, modes, and operating principles and techniques. Additionally,
they reported differing pilot decisions about the appropriate level of automation to use
or whether to turn the automation 'on' or 'off' when they get into non-normal
situations. The report also highlighted potential mis-matches between
manufacturers' assumptions about how the flightcrew will use the automation.
Furthermore, the report commented on the vulnerabilities in situational awareness,
such as: mode awareness and flightpath awareness, including terrain and energy
awareness. The team concluded that these “vulnerabilities are there because of a
number of interrelated deficiencies in the current aviation system” (FAA, 1996 p3).
They also highlighted the lack of sufficient knowledge and skills of designers, pilots,
operators, regulators and researchers. “It is of great concern to this team that
investments in necessary levels of human expertise are being reduced in response to
economic pressures when two-thirds to three-quarters of all accidents have
flightcrew error cited as a major factor” (FAA, 1996 p3).
December 2004 Chapter 1 Page 3CAA Paper 2004/10 Flight Crew Reliance on Automation
3.3 BASI Advanced Technology Aircraft Safety Survey Report 1998
Pilots expressed strongly positive views about advanced technology aircraft.
Although some reported difficulties with mode selection and awareness on flight
management systems, most pilots did not consider that too many modes were
available. Many respondents gave examples of system 'work-arounds' where they
were required to enter incorrect or fictitious data in order to ensure that the system
complied with their requirements. The most common reasons for system 'work-
arounds' were to comply with difficult air traffic control instructions and to
compensate for software inadequacies during the descent approach phase of flight.
The content and standard of instruction was not considered to provide adequate
knowledge required to operate their aircraft in abnormal situations. Traditional airline
check-and-training systems, developed to maintain flight standards on earlier
generations of aircraft, did not necessarily cover all issues relevant to the operation of
advanced aircraft. For example, the survey identified that there is the potential for
pilots to transfer some of the responsibility for the safety of flight to automated
systems, yet problems such as this are not generally addressed by check-and-training
systems.
3.4 Assessing Error Tolerance in Flight Management Systems 1998
Courteney (1998) presented the results of a study which reinforces the conclusions
of the BASI study by highlighting the predominance of 'work-arounds'. This study
raises the question that there are human factors issues beyond the more commonly
accepted problems of mode complexity. “This includes crew being distracted by
incompatibility between the FMS design and the operating environment, incorrect
data and anomalies in the system, as well as training and procedures that are not
sufficient for comprehensive system utilisation”.
3.5 ECOTTRIS 1998
The research was designed to improve the existing transition training procedures for
pilots moving from conventional to advanced automated cockpits. The study reported
a striking lack of standardisation between, and within, manufacturers for design
philosophies of automated systems. On top of that airlines then adopt different
Standard Operating Procedures regards the use of automation e.g. some airlines
prohibit the use of certain modes; however, the trend is for an increasing prescription
for the use of automation. Incident and accident reports from both European and US
sources were analysed. Contrary to previous studies only 6% of reports were
concerned with mode awareness but deficient CRM factors accounted for 39%. This
was linked with incorrect settings, monitoring and vigilance, inadequate knowledge
of aircraft systems, experience and flight handling.
3.6 ESSAI 2003
The Enhanced Safety through Situation Awareness Integration in training (ESSAI)
programme sought to offer potential training solutions for improved safety by
enhancing situation awareness and crisis management capability on the flight deck.
The results indicated that situation awareness skills could be improved by training
using a non-interactive DVD, a classroom activity to reinforce skills presented on the
DVD and then two demanding Line Orientated Flight Training (LOFT) scenarios plus
instructor led de-briefs.
3.7 HF Implications for Flight Safety of Recent Developments in the Airline
Industry 2001
The JAA commissioned a study (Icon, 2001) to determine if there was an impact on
flight-deck safety as a result of commercial developments such as: deregulation,
December 2004 Chapter 1 Page 4CAA Paper 2004/10 Flight Crew Reliance on Automation
liberalisation and privatisation. The report identified three outcomes of commercial
developments that have an effect on flightcrew: multicultural flight crew, merging of
company cultures, and commercial pressures. Apart from the obvious concerns over
differences in languages with multi-national crews there were other potential
problems such as: reduced interaction both on- and off-duty, different SOPs, different
interpretation of CRM, and differing levels of technical knowledge. It was concluded
that when airlines merged or became part of a strategic alliance individual company
cultures remained largely unaffected, thus creating the situation of flight-deck
crewmembers operating with differing approaches to the overall task. Increases in
commercial pressure were deemed to increase fatigue and the potential to reduce
training budgets to the absolute minimum to satisfy regulatory requirements.
However, the report highlighted mitigation of these concerns through the appropriate
development of CRM and SOPs, and the adoption of an appropriate safety culture
within the organisation. These commercial factors will therefore influence automation
failures attributable to the organisational elements.
4 Training Regulations and Requirements
4.1 General
A review of JAR-FCL 1 (JAA, 2003a), JAR-OPS 1 (JAA, 2003b) and other related
material was made and several discussions were held with CAA personnel from the
relevant departments to gain an understanding of these documents. A review of such
documents is not presented here for obvious reasons; however, the content of these
Requirements is discussed in Chapter Three.
December 2004 Chapter 1 Page 5CAA Paper 2004/10 Flight Crew Reliance on Automation
Chapter 2 Review of Data
1 Review of Incident Data
1.1 UK CAA MOR
1.1.1 A search of the CAA MOR database was made using the following keywords: Airbus,
Boeing and Embraer FMS, autopilot and automation/automatic problems for the
period 1st January 2002 to 31st December 2003. The search yielded 147 pages of
data which have still to be classified. Unfortunately, the keyword search did not
capture all the problems associated with this topic; another search associated with an
icing project yielded hitherto un-retrieved reports.
1.1.2 One qualitative observation of the data was apparent: in turbulence, aircraft speed
variation resulted in the crew disconnecting the autopilot completely so that they
could then fly the aircraft manually to control speed using pitch. This action results in
an altitude bust (often the cause of the report in the first place).
1.1.3 An incidental observation was made during the course of this study. The content of
the reports is very thin. Reporters do not provide much detail and therefore much
valuable information is never recorded. Additionally, keyword searches do not capture
all reports of interest to human factors research. It is recommended that a study be
undertaken to determine if this valuable tool could be further refined for the purposes
of tracking HF issues.
1.2 FODCOM 20/2002
The CAA has issued FODCOM 20/2002 on 29 August 2002. This FODCOM gives
additional guidance to crews on the handling of aircraft with advanced
instrumentation in turbulent conditions and required operators to review their
procedures to take account of the FODCOM. The incident data, which spans 2002 to
2003, will be reviewed to determine if there was a significant change in events of this
nature following the issue of this FODCOM.
December 2004 Chapter 2 Page 1CAA Paper 2004/10 Flight Crew Reliance on Automation
Chapter 3 Discussion
1 General
1.1 Issues Highlighted for Investigation by CAA
1.1.1 As automation has taken over more and more of the manual skills of the pilot there is
a risk that if the automation should fail then the pilot may not have the necessary skills
to recognise, decide and take appropriate action to recover the situation. The CAA
raised three issues:
• Automation dependency
• Loss of manual flying skills
• Inappropriate crew response to failures
1.1.2 Failures of automation can be grouped into a number of areas. A failure could occur
due to the automation system itself failing; a partial failure i.e. one function within a
system, or a total failure of a system e.g. loss of autopilot. There could be a failure
due to incorrect programming either from the pilot or from a secondary system
providing incorrect data. Other failures may originate at an organisation level due to
inappropriate procedures or as a result of the procurement of insufficient / inadequate
training or education, or, failures may occur as a direct result of the design of the
automation itself.
1.1.3 Examples of these different types of failures are given in the following paragraphs.
The research indicated that there was much evidence to support the concern that
crews were becoming dependent on flight deck automation. Furthermore, the new
pilot function of system monitoring was dependent on the reliability of the automation
itself. There was little research to provide a structured basis for determination of
whether crews of highly automated aircraft might lose their manual flying skills.
However, anecdotal evidence elicited during interviews and a brief mention in the
ECOTTRIS study indicates that this is a concern amongst practitioners. The term
“manual flying skills” is not fully defined and different organisations may use the term
to mean slightly different things. Some definition needs to be included at the start of
any further investigations such as: which skills are degraded, how can the change be
quantified, and which pilot groups are affected. Finally, several MOR incidents
revealed that crews do respond inappropriately having made an incorrect diagnosis of
their situation in which the automation fails. For example, disconnecting the autopilot
following an overspeed in turbulence then resulted in altitude busts.
1.1.4 Additionally, during the course of this research two more fundamental observations
were made. First, pilots lack the right type of knowledge to deal with control of the
flight path using automation in normal and non-normal situations. This may be due to
incorrect interpretation of existing requirements or lack of a comprehensive training
curriculum that encompasses all aspects of the published requirements. Second,
there appears to be a loop-hole in the introduction of the requirements for CRM
training that has resulted in many of the training personnel and managers responsible
for the ethos and content of training programmes not fully understanding the
significance of the cognitive aspects of human performance limitations. These
observations will be discussed further in the following paragraphs.
December 2004 Chapter 3 Page 1CAA Paper 2004/10 Flight Crew Reliance on Automation
2 Automation failures
2.1 Normal Operation
2.1.1 The starting point for 'automation failures' is the acknowledgement of the
inadequacies of the human-machine relation in the 'normal' case. Even with a fully
serviceable system the crew, under certain situations, are already under increased
workload to compensate for the design of the system thereby producing a
deterioration in situational awareness bought on, in part, by the automation itself
(Dekker and Orasanu, 1999). Therefore, the consequence of even the smallest of
'failures' may, depending upon situation, jeopardise the safe conduct of the flight.
2.1.2 Therefore, training should be improved to provide crews with a better understanding
of the operation of the automation in the normal case as well as in response to the
failure situation.
2.2 Automation System Failure
2.2.1 Consider a 'failure' of either the autopilot, autothrust or the flight management
system. There could be a partial failure i.e. one function within a system e.g. altitude
hold, or a total failure of a system e.g. loss of autopilot.
2.2.2 The Flight Crew Operating Manuals and CBT for the B747-400 and the A340 provide
information on how the systems works and the basic method for normal operation
and hardware failures. Procedures are supplied for use in the event of the display of
a warning messages for total failure of the autopilot, autothrust, or flight management
systems. Clearly, these failures will present the crew with a rule-based procedure that
can be applied to recover or mitigate the situation. It is the role of the manufacturer
to provide recommended procedures in the form of checklists; however, these
procedures specifically do not include elements of 'airmanship'. Operators should
ensure that training programmes include means and standards to be met regarding
the interaction of Human Performance and Limitations with changes to the normal
operation of the automation. This will, necessarily, be material that is in addition to
that provided by the manufacturer. Procedures should be taught and trained in the
context of an operating environment i.e. the procedure should not be covered as a
button-pushing drill but more to highlight the differences to the workload and
management of the operational task.
2.2.3 Both manufacturers stipulate procedures for input of data and cross-checking
response of system modes. Airbus have included “Ten Golden Rules” as a result of
operational feedback and individual operators have developed and published
philosophies of operation to guard against complacency and human errors e.g. long-
haul operator - very simple use of automatics; short-haul – AP at 1000 ft after take-off.
But the studies discussed previously clearly indicate that pilots, who have access to
all these written philosophies and procedures still confuse modes or make
inappropriate decisions.
2.3 Programming/Input Failure
2.3.1 A programming failure may a occur when the automation is functioning normally but
incorrect data has been input through either incorrect action by the pilot, or where a
sub-system or associated system failure provides incorrect data to an automated
system. Systematic errors may occur, for example, when databases used for
navigation are incorrectly programmed. The very rare nature of these events places
the human reaction into the “Complacency – over-reliance on automation” class that
was discussed earlier. The Mount Erebus incident is an example of this type of failure.
December 2004 Chapter 3 Page 2CAA Paper 2004/10 Flight Crew Reliance on Automation
2.3.2 A further example comes from a recent VOR approach into Addis Ababa, a GPWS
warning was received while the raw VOR signal and FMS provided compelling data
that the aircraft was on track. In fact a number of factors conspired to place the aircraft
some 4.5nm to 7.7nm off track. Disparate data was presented to the crew in the form
of an unexpected altitude call-out, and an NDB bearing that was at odds with the VOR/
FM position. As it happened the VOR was in error and this produced an error in the
FM position. However, the initial reaction was to believe the VOR because it was in
agreement with the FM position and reject (or not use the information) from the NDB.
The weighting of belief was in favour of the automation. If the crew had been flying
a 'raw' VOR approach then the only other information available, i.e. the NDB, would
have featured more prominently as a disagreement.
2.4 Organisation Failure
2.4.1 Organisation failure can occur when the organisation and management controlling the
flight operation fails to ensure that the policies and procedures stipulated are coherent
with the operational task. For example, incident reports cite cases where the use of
ACARS to provide loadsheet information during taxy appears efficient from a
commercial point of view but may provide a distraction during a critical moment prior
to take-off. Other points were elicited during interviews such as the handling of flight
critical data. Efficiencies are technically possible by using ACARS to request take-off
data calculations. However, there is a concern that pilots will, in time, become used
to merely reading data from one computer output into the input for another computer
without 'thinking' about the accuracy or reasonableness of the data. This contrasts
with the process of using a manual of tabulated data or graphical data where although
the opportunity for mis-reading still exists at least there is a range of data presented.
With an ACARS print out there is only the single answer and an incorrect input figure
may not be easily apparent. An example was recently presented concerning an A340-
600 where the take-off weight was input as 240T instead of 340T. The resulting take-
off performance figures were quite reasonable for an A340-300 and therefore familiar
to the dual rated crew who failed to notice the error despite careful read-backs and
cross-checks (it was the relief pilot who highlighted the error).
2.4.2 Integration of all aspects of human cognitive behaviour and the requirements of a
commercial operation are necessary if policies and procedures are to be optimised for
safety as well as efficiency considerations. Regulatory explanatory material should
provide information to operators on specific areas to include in training programmes
and 'best' practice for policies and procedures.
2.5 Design failure
2.5.1 There are substantial obstacles such as lead-time and costs before 'in-service'
experience is fed back into new designs. Moreover, current designs have become
accepted and indeed form the basis for common type ratings across a number of
variants. Therefore, a single change must be incorporated in a variety of platforms.
Notwithstanding the importance of continuing work to improve designs there will still
be the problem of dealing with the in-service designs that could be with us for the
next 30 years. It is for this reason that this report concentrates on the human aspect
of automation issues.
2.5.2 As discussed in Couteney's paper known problems promote 'workarounds';
unknown problems require initiative, knowledge and experience to deal with. One of
the 'workarounds' quoted in interviews was the conscious decision by one airline to
not use the full automation capability of an aircraft on its initial introduction. As
experience was gained procedures were adapted and the use of certain functions
was trained and encouraged.
December 2004 Chapter 3 Page 3CAA Paper 2004/10 Flight Crew Reliance on Automation
3 Regulations for Training Requirements
3.1 JAR FCL
JAR-FCL 1 (JAA, 2003a) was first issued in 1997, with amendments in 2002 and
2003, and was predominantly a harmonisation of existing standards within the JAA
area. There was no attempt to conduct a 'training needs analysis' as such to verify
that extant standards were effective and comprehensive. However, a review of
previous standards reveals little change in philosophy over the years despite the
acknowledged changes in the operational task facing pilots. The current Flight Crew
Licence requirements indicate what the training courses should achieve in terms of
syllabus and learning objectives but there is little guidance on how to achieve the aim.
This level of detail is left to the Flight Training Organisations and airlines. The structure
of the licence requirements has changed little since the end of the Second World
War.
3.2 Initial Stages of Training
3.2.1 During initial training simple aircraft are utilised to concentrate on the basics of aircraft
operation. Theoretical knowledge regarding aircraft systems is taught in an academic
fashion and each system is treated in isolation during teaching and examination. The
examination covers 9 subject areas and the majority of questions are in multiple
choice format, with no penalty marking, and a 75% pass mark. Normal operation of
aircraft systems and cross-system effects are highlighted during simulator training
and reinforced during initial flight training. In parallel, flight skills, flight operations and
flight procedures are introduced in the classroom with theoretical knowledge
teaching and examination being conducted in the same fashion as aircraft systems.
Simulation and initial flight training develop the motor schema required for manual
flying (JAA, 2003a).
3.2.2 This learning/training process is consistent in so far as it is applied to the ab initio
stage where the aircraft systems are simple, the weather is usually benign, the air
traffic environment is simple, and the operating task minimal i.e. no time constraints
or external commercial pressures. The architecture and operation of the simple
aircraft systems can be easily and fully explained in the classroom and the
examination process validates the students recall. The simulator and in-flight training
allows the student to learn and practise the rule-based behaviour required to manage
the systems and, to an extent, increases the students understanding of the systems.
Operation and management of the systems requires the same level and type of
cognitive activity as that employed during the examination stage i.e. memory recall.
In a similar fashion the motor schema required for manual flying are developed
through classroom (knowledge) to simulator and flight training (rule). The skill is
developed with manual flying practice and is examined in context by performing the
operational task. At the end of this stage the pilot can manually fly an aircraft to
complete a basic operational task (control of the flight path) and the teaching/training
and examination process has validity.
3.2.3 Before proceeding further it is important to understand the process by which we
acquire and use knowledge.
3.3 The Concept of Knowledge
The three basic domains of cognition are: perception, memory, and thinking. The
boundaries of these domains are indeterminate; however, the processes involved in
each have a bearing on how we assimilate and employ knowledge. Studies of
amnesia have shown that the brain handles certain types of memory in physically
different ways. This results in the classification of two types of knowledge: procedural
December 2004 Chapter 3 Page 4CAA Paper 2004/10 Flight Crew Reliance on Automation
and declarative. Procedural knowledge is knowing how: to ride a bicycle or how to
manually land an aircraft in a cross-wind. Declarative knowledge, in contrast, is
knowing that: an aircraft uses Jet A1 fuel or that the auxiliary power unit can be used
to replace the loss of an engine electrical generator. Declarative knowledge also
includes episodic memory, the memory of a specific event. It should be obvious that
one can have procedural knowledge without declarative knowledge of a subject and
vice-versa. For example, one can ride a bicycle but it is unlikely that one can explain
the principles of conservation of angular momentum that describe why we don't fall
off! Equally, Dr. John Fozzard, the lead design aerodynamicist for the Harrier, can
explain why a jump-jet can hover but would not relish the opportunity to demonstrate
the effect at the controls.
3.4 Requirements for CPL/ATPL
Appendix 1 to JAR-FCL 1.470 sets out the theoretical knowledge requirements for
the ATPL (A) licence. These syllabi are expanded in the associated Learning
Objectives. Unfortunately, the reality is that students only learn what is required for
the exam of the individual module. At present there is little consideration given to the
introduction of automation as an integral component of the flight deck task. Rather
the topic is treated as a 'system' and as such consigned to the same format as
hydraulics, electrics etc. Rignér and Dekker (1999) state: “If the goals of flight
education are to make the pilots able to transfer their knowledge (from the training
situation to the airline environment), so they can manage both routine and novel
situations, training methods that rely on reproductive memory do not make the
grade.” So, once the student has gained his ATPL (A) Theoretical Knowledge credits
he has acquired a limited level of declarative knowledge but very little procedural
knowledge that is relevant to working with the automation of a modern flight deck.
3.5 Type Rating
3.5.1 Once again theoretical knowledge for the Type Rating is presented and assimilated
as declarative knowledge. Individual systems and individual multiple choice exam
format. Some procedural knowledge is introduced in the form of practical training in
the use of autopilot, autothrust and flight management systems. However, the
training is limited to use of system in normal mode and with hardware failures only.
In fact, the complex nature of these systems means that the limited exposure of
these sessions is often accompanied by the phrase “Don't worry about that, you will
pick that up on the line”.
3.5.2 During the research for this report a review of CBT packages for the B747-400 and
the Airbus A340 autopilot and FMS modules was made. In summary, what was
presented amounted to an exposition of the capabilities of the systems themselves.
Individual facets of each system were presented with occasional use of the phrase
“the use of the equipment will be made clear in the sessions on the simulator or
training device”. However, interviews with ground training personnel yielded
comments that the normal procedures and non-normal situations, for which there
was a published procedure, were covered but there was little, if any, time allocated
to the presentation of Human Performance Limitations and the management of the
automation in realistic settings. Again, this is dealt with during Line Training. Further
interviews with training captains produced comments that during Line Training,
opportunities to demonstrate anomalies were limited, unless the situation just
happened to present itself. Clearly, at this stage of training, there would be no
question of demonstrating automation failures by deliberately downgrading system
capability. So at the end of the Type Rating training the pilot is competent to manage
the system in a normal situation based on declarative knowledge but has little
experience or procedural knowledge of normal operation and even less in the case of
failure, i.e. non-normal situations.
December 2004 Chapter 3 Page 5CAA Paper 2004/10 Flight Crew Reliance on Automation
3.6 Proficiency Checks
3.6.1 The requirements for the Skills Tests contained within JAR-FCL (JAA, 2003a) and
amplified in Standards Document 24 (CAA, 2003b) are heavily weighted towards the
checking of the manual flying skill of the pilot. Specific guidance is given on the
tolerances on flight path parameters that must be achieved and also the manner in
which such targets are satisfied. However, the issue of controlling the flight path by
means of the autopilot and FMS and the demonstration of such skill is grouped with
'other aircraft systems'. Indeed, one may infer that such skill is deemed of a low
priority given that this facet is only required to be evaluated once every three years
and there is no stipulation as to the degree of competence that is required.
3.6.2 Standards Document 24 does make specific mention of the use of automation for the
departure and arrival phases but this is done in a 'concessionary' manner, viz.
“Item 3.9.1 - Departure and Arrival Procedures, […] b) Full use of automatics
and LNAV if fitted is permitted. Examiners are encouraged to use their
imagination to obtain maximum benefit from this item of the test. For example,
if LNAV is used, a departure with a close in turn that may require some speed
control or a change to ATC clearance that may require some reprogramming of
the FMS might be appropriate. […] g) If the arrival procedure contains a hold,
this can be assessed. Automatics can be used and therefore value can be
obtained by giving a last minute clearance into the hold, or if FMS is fitted, an
early exit from the hold to see how the FMS is handled.” (CAA, 2003b p11)
3.6.3 Furthermore, the specific paragraph entitled “Automatics” reinforces this idea that
the automation may be used as a concession. These words do little to highlight the
complex nature of modern automation and the degree of competence that is
necessary for safe and consistent application of this tool across the range of
situations that are commonly met in contemporary commercial operations.
3.7 Knowledge of Manual Flying vs Automatic Control
3.7.1 From the initial stages of flying training pilots develop skills to manually control the
flight path in a feed-forward type of behaviour. This means that when recognising an
error in the flight path performance the pilot makes a control input in anticipation of a
desired response – they think ahead in a pro-active manner. However, studies have
shown that pilots operating modern automation for flight path control do not have the
knowledge or understanding to predict the behaviour of the automation based on
detection of an error and selection of a control input. They cannot always predict the
behaviour or feedback cues of the systems modes; as a result it may be said that they
behave in a feedback or reactive manner - they are behind the aircraft.
3.7.2 As illustrated above there is a recognisable difference in the way humans (pilots)
handle certain types of knowledge. The basic skills associated with 'manually flying'
an aircraft are predominantly based on procedural knowledge i.e. how to achieve the
task. However, the use of automation to control the flight path of an aircraft is taught
as declarative knowledge. Pilots are required to manage systems based on a
knowledge that the autoflight system works in a particular fashion. So, the pilot is
faced with the same operational task of controlling the flight path but employs two
different strategies of cognitive behaviour depending upon whether the task is
manually or automatically executed. As discussed above the current requirements for
licence and type rating issue prescribe standards and experience in the procedural
knowledge of manual control of the flight path; however, there are no similar
requirements to ensure appropriate standards and experience for the procedural
knowledge of control of the flight path using automation.
December 2004 Chapter 3 Page 6CAA Paper 2004/10 Flight Crew Reliance on Automation
3.7.3 It may be concluded that pilots lack the right type of knowledge to deal with control
of the flight path using automation in normal and non-normal situations. This may be
due to incorrect interpretation of existing requirements or lack of a comprehensive
training curriculum that encompasses all aspects of the published requirements. It
suggested that there should be a shift in emphasis in the way automation for flight
path control is taught and trained. Further research is required to identify the cause
and provide a solution.
3.8 Crew Resource Management
3.8.1 Crew Resource Management (CRM) was introduced into commercial aviation during
the late 1970's. It was initially based upon concepts adapted from business
management behaviour programmes in the US. Predominantly, initial CRM topics
were limited to behavioural and physiological aspects. These concepts were refined
during the 1980's to include psychological topics and mandated as part of the licence
requirements following AIC 18/1991 (CAA, 1991). All licence holders prior to
1st January 1992 were exempt from the Human Performance and Limitations exam
but were required to undergo an Initial CRM course on joining a new company and to
undergo recurrent training on an annual basis. Since then the emphasis for CRM has
strengthened in terms of the practical application of the behavioural marker system,
NOTECHs etc., resulting in the recently published Standards Document 29 (CAA,
2001) and accompanying CAP 737 (CAA, 2003c). However, the areas relating to the
practical application of the cognitive elements of human performance, in particular in
relation to the human-machine operations, have not been as widely promoted nor
understood.
3.8.2 Training and management pilots who are required to implement JAR-OPS
requirements are, for the most part, in the category of licence holders who were
exempt from the Human Performance and Limitations exam. Following interviews
they appeared to fall into two classes that either thoroughly endorse all aspects of
Human Performance and Limitations i.e. behavioural, physiological and cognitive
limitations, or still view CRM as limited to behavioural aspects of flight deck operation.
All requirements and regulations are subject to 'interpretation'. It appears that the
requirements for training in, and the application of, the cognitive elements of human
performance on the flight deck and their impact on the operations of highly automated
systems has been better understood by some than others. It is only by obtaining a
thorough understanding of the cognitive limitations of pilots in the flight deck
environment that operational policies and procedures can be effectively
implemented.
3.8.3 It may be concluded that there was a loop-hole in the introduction of the requirements
for CRM training that has resulted in many of those responsible for the oversight of
training programmes not fully understanding all the cognitive aspects of human
performance limitations.
3.9 Line Oriented Flight Training
Interviews with training personnel revealed that the principles of LOFT are included
in design of OPC / LPCs; however, LOFT as an exercise in itself was only included as
part of the recurrent training schedule if time and resources were available. However,
LOFT is a valuable tool for examining and training procedural knowledge of how to fly
the aircraft using automation and yet may not be fully included in training budgets.
December 2004 Chapter 3 Page 7CAA Paper 2004/10 Flight Crew Reliance on Automation
Chapter 4 Conclusions and Recommendations
1 Dependency on Automatics Leads Crews to Accept what the Aircraft is
doing without Proper Monitoring
1.1 Summary
1.1.1 The availability of automation and automated decision aids encourages pilots to adopt
a natural tendency to follow the choice of least cognitive effort. Training crews on
automation bias or to verify correct automated functioning had no effect on
automation-related omission errors, and neither did display prompts that reminded
crews to verify correct functioning. However, there was evidence that pilots did
perform better when the event was flight critical in nature.
1.1.2 There are two distinct types of knowledge that pilots have:
a) Declarative knowledge – the knowledge that the system works in a certain way.
b) Procedural knowledge – knowing how to use the system in context.
The use of automation to control the flight path of an aircraft is taught mainly as
declarative knowledge. Pilots are required to manage systems based on a knowledge
that the autoflight system works in a particular fashion, this is different for manual
flying skills.
Manual Flying
The current requirements for licence and type ratings issue prescribe standards and
experience in the procedural knowledge of manual control of the flight path, pilots are
required to know and demonstrate how to control the flight path manually.
Automated Flying
There are no similar licensing or type rating requirements, to ensure appropriate
standards and experience for the procedural knowledge of how to control the flight
path using automation. Pilots are taught that the automation works in a particular way
but their ability to use it is not checked to anywhere near the extent of checks for
manual flying skills.
1.1.3 Therefore, it may be concluded that pilots lack the training and checking for control of
the flight path using automation in normal and non-normal situations. Document 24
requires demonstration of the task of flight path control; however this is heavily
weighted towards manual skills. Demonstration of proficiency in controlling the flight
path using the automation is included as a secondary concern for the departure and
arrival without detailed guidance on manoeuvres or tolerances to be achieved, which
is in contrast to the guidance provided for the manual skill check.
1.1.4 The point at which a pilot would intervene in an automated process is fundamental to
a successful outcome. This is not a well defined training goal and how and when
decisions are made is variable within flight crews and organisations. The level busts
resulting from disconnection of the autopilot during a turbulence induced overspeed
event is evidence of incorrect intervention strategy.
1.1.5 Type rating training is limited to use of autopilot and FMS system in normal mode and
with hardware failures only. CBT packages for the B747-400 and the Airbus A340
autopilot and FMS modules amount to an exposition of the capabilities of the systems
themselves. Without adequate knowledge it is more likely that flight crews will
accept what the aircraft is doing because they do not always have the knowledge or
experience to predict the results of the automation targets and modes displayed.
December 2004 Chapter 4 Page 1You can also read
